NGINX Configuration

In order forFor the plugin to gatherobtain the statistics, HAProxyNGINX must expose the /stats;csvstub_status endpoint. ThisEnabling it is done by editing the haproxy.cfgNGINX configuration file (by default location:at /etc/haproxy/haproxy.cfgnginx/nginx.conf or /etc/nginx/sites-available/default).

The ngx_http_stub_status_module module is not included in every NGINX build. To verify whether it is available, run nginx -V 2>&1 | grep stub_status. Most Linux distributions include it by default.

MinimumMinimal configuration (no authentication, no SSL)

Add a dedicated frontendlocation for statistics:the status inside your server:

frontendserver stats{
    bindlisten *:840480;
    statsserver_name enable_;

    stats urilocation /statsnginx_status stats{
        refreshstub_status 10son;
        access_log off;
        allow 192.168.1.50;   # Pandora FMS server IP
        deny all;
    }
}

With this configuration the plugin will consume the URL:

http://<SERVER_IP>:8404/stats/nginx_status

The plugin automatically normalizes the URL by appending the ;csv suffix and the norefresh parameter when missing, so it is enough to provide the base stats URL.

Configuration with basic authentication

To protect the endpoint with a username and password, define a userlistauth_basic and apply http-request authauth_basic_user_file onin the statsstatus frontend:location:

frontendserver stats{
    bindlisten *:840480;
    statsserver_name enable_;

    stats urilocation /statsnginx_status stats{
        refreshstub_status 10son;
        aclaccess_log auth_okoff;
        http_auth(stats_users)auth_basic http-request"NGINX authStatus";
        realmauth_basic_user_file stats/etc/nginx/.htpasswd;
    if}
!auth_ok

userlist stats_users
    user admin password $6$rounds=5000$<SHA512_HASH>}

Generate the password.htpasswd hashfile with mkpasswdhtpasswd or openssl:

mkpasswdhtpasswd -mc sha-256/etc/nginx/.htpasswd mypasswordadmin
# or
openssl passwd -6apr1 mypassword > /etc/nginx/.htpasswd

In the plugin, theThe same username and password must be provided to the plugin through --user / --password (or the username / password fields inof the configuration file).

Configuration with SSL/TLS

To serve the statsstatistics over HTTPS,HTTPS addconfigure sslthe crtcertificate toin the bindserver directive::

frontendserver stats{
    bindlisten *:8404443 sslssl;
    crtserver_name _;

    ssl_certificate     /etc/haproxy/nginx/certs/stats.pemstatus.pem;
    stats enable
    stats urissl_certificate_key /statsetc/nginx/certs/status.key;

    statslocation refresh/nginx_status 10s{
        stub_status on;
        access_log off;
        allow 192.168.1.50;
        deny all;
    }
}

Generate a self-signed test certificate for testing with:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/haproxy/nginx/certs/stats.status.key \
  -out /etc/haproxy/nginx/certs/stats.status.crt \
  -subj "/CN=localhost"
cat /etc/haproxy/nginx/certs/stats.status.crt /etc/haproxy/nginx/certs/stats.status.key > /etc/haproxy/nginx/certs/stats.status.pem

In the plugin, point toplugin the URL will be indicated with the https:// scheme and set the --ssl parameter (or verify_ssl) parameter depending on whether the certificate should be validated:

• verify_ssl = true → for valid certificates in production.
• verify_ssl = false → for self-signed certificates or testingtest environments.

CompleteFull configuration (SSL + authentication)

globalserver maxconn{
    4096listen defaults443 modessl;
    httpserver_name timeout_;

    connectssl_certificate     5s/etc/nginx/certs/status.pem;
    timeoutssl_certificate_key client/etc/nginx/certs/status.key;

    30slocation timeout/nginx_status {
        stub_status on;
        access_log off;
        auth_basic "NGINX Status";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

server 30s{
    frontendlisten stats80;
    bindserver_name *:8404_;
    sslreturn crt301 https:/etc/haproxy/certs/stats.pem/$host$request_uri;
stats enable
    stats uri /stats
    stats refresh 10s
    stats admin if TRUE

    acl auth_ok http_auth(stats_users)
    http-request auth realm stats if !auth_ok

userlist stats_users
    user admin password $6$rounds=5000$<SHA512_HASH>

frontend myapp
    bind *:80
    default_backend servers

backend servers
    server s1 127.0.0.1:8080 check}

After modifying haproxy.cfg,the NGINX configuration, reload the service to apply the changes:

sudo systemctl reload haproxynginx

Verification

To confirmverify that the endpoint is respondingresponds correctly, you can make a manual request to the statsstatus CSV:page:

curl -u admin:mypassword http://192.168.0.10:8404/stats;csv10/nginx_status

The output must be aplain CSV whose first record is the headertext with the columnfollowing namesformat:

Active connections: 291
server accepts handled requests
 16630948 16630948 31070465
Reading: 6 Writing: 179 Waiting: 106

• Active connections: total number of active connections (#includes pxname,svname,qcur,qmax,waiting ones)...)
and
• accepts: total connections accepted since NGINX started.
• handled: total connections handled since NGINX started.
• requests: total client requests processed since NGINX started.
• Reading: connections reading request headers from the followingclient.
rows
• containWriting: connections writing a response to the dataclient ofor eachprocessing frontend,a backendrequest.
and
• server.
  Waiting: idle keep-alive connections waiting for the next request.